The main point of this PR is that the sled-agent config reconciler now always attempts to destroy datasets it believes have been expunged instead of defaulting to reporting them unless an operator has toggled a chicken switch. (See the comments on datasets_destroy_orphans() for details; this is pretty specific to only destroy datasets whose names we understand.) We wanted to ship "report only" in R16 and then confirm during upgrades that this wasn't showing any surprises; now that R16 is out the door we can turn this on all the time.

This also (starts to? attempts to?) removes the sled-agent API endpoints for interacting with the chicken switches. The openapi xtask yelled at me for this, so instead I followed the guide for removing endpoints. This was almost entirely painless, except that I'd already (locally) committed the change to remove the endpoints mixed in with other things, so I had to dig back out the endpoints and the types they used. Kudos to all involved for the tooling and instructions here!

Closes #6177. Closes #7312 (no longer needed). Closes #7313.

Edit: The diff stat here is laughably misleading; the API change means we have to check another full copy of the sled-agent API document, which is ~8000 lines. The changes here are a couple hundred lines.